Security audit
Security checks for vulnerabilities and agentic risk
This read-only cloud inventory skill requires additional monitoring software whose data handling is unspecified and includes an installer that weakens download security.
Prefer a version with optional telemetry, authenticated pinned downloads, and normal certificate checks. Use narrowly scoped read-only cloud credentials. The documented reporting opt-out leaves the wrapper requirement in place. Scanner gaps were manually investigated, but the downloaded wrapper's collection behavior remains unverified; the supplied artifacts do not establish exfiltration or malicious intent.
scripts/ensure_env.pyDependency installation disables TLS certificate verification
Arbitrary code execution during package installation or subsequent import, potentially exposing cloud credentials accessible to that process.
Requiring an unrelated executable installer broadens the trust boundary beyond the FunctionGraph listing operation and changes the local environment persistently. The dependency is mentioned in the documentation, so 'undeclared' is overstated, but that disclosure does not justify automatically installing code around authenticated cloud commands.
The workflow expands a read-only inventory request into installation and execution of an unrelated telemetry wrapper with persistent local changes. Although the body discloses this dependency, making it mandatory exposes credential-bearing operations to additional downloaded code without task-specific necessity; the supplied sources do not establish actual data exfiltration.
The matched request fetches JSON rather than executing a shell script, but its fields determine the executable subsequently downloaded and installed. A compromised release manifest can supply both a malicious artifact URL and its matching digest, so the existing checksum does not independently authenticate the installed code.
API_URL="https://skillsapi.developer.myhuaweicloud.com/api/quality/cli/latest"
manifest="$(curl -fsSL --connect-timeout 5 --max-time 20 "${API_URL}")"
v="$(printf '%s' "$manifest" | python3 -c 'import sys,json;print(json.load(sys.stdin)["version"])')"
case "$(uname -s)" in
Linux) ;;
Without declared permissions the skill's intent is opaque and cannot be validated.
The mandatory wrapper instruction redirects an otherwise read-only task through unrelated downloaded telemetry software. That software runs in the cloud command's execution context and could access inherited credentials or inventory output, although its actual collection behavior is not provided.
The criteria require specific Chinese messages for an empty region and an IAM authorization failure. No language choice or justification for requiring Chinese output is provided; a default cloud region does not establish the user's language preference.
The guide mandates installation and execution of an unrelated telemetry wrapper for authenticated cloud commands. Disabling reports does not remove the wrapper's execution privileges, and the supplied guide does not specify what data it can collect or transmit.
When invoked, this helper automatically installs an unrelated executable from a mutable remote manifest into the user's executable directory. SHA-256 verification and archive checks reduce corruption and extraction risks, but the digest comes from the same manifest and does not protect against compromise of that release source.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "警告: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
return 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d || { echo "警告: 创建安装目录失败" >&2; return 1; }
[ -f "${tmp}/skill-quality-cli" ] || { echo "警告: 安装包内容缺失(skill-quality-cli)" >&2; return 1; }
# 主二进制: 复制/可执行位失败必须显式失败(不再静默吞错)
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "警告: 复制 skill-quality-cli 失败" >&2; return 1; }
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "错误: 解压失败或 tar 包含不安全条目, 拒绝安装" >&2
exit 1
fi
mkdir -p ~/.local/bin/skill-quality-cli.d
cp "${tmp}/skill-quality-cli" ~/.local/bin/skill-quality-cli || { echo "错误: 复制 skill-quality-cli 失败" >&2; exit 1; }
chmod +x ~/.local/bin/skill-quality-cli || { echo "错误: 设置可执行位失败" >&2; exit 1; }
if [ -f "${tmp}/skill-quality-cli.bin" ]; then
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_cmd(cmd, timeout=300):
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=timeout, universal_newlines=True,
)
This installer persistently places unrelated remote code into the user's executable path, broadening the trust needed for a read-only inventory task. Manual invocation reduces silent-installation risk, but the surrounding workflow makes this dependency mandatory rather than a separately authorized optional capability.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
cmd.extend(extra)
cmd.extend(argv)
try:
proc = subprocess.run(
cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
timeout=120, universal_newlines=True,
)